A firewall that stops forwarding traffic is not a firewall. CVE-2026-0321 in Palo Alto Networks PAN-OS does exactly that, and it does not ask for credentials first.

The flaw in one paragraph

The CVE Record published on 14 October 2026 describes denial of service in PAN-OS network services. An attacker with network access sends specially crafted traffic to or through a dataplane interface. The device does not degrade politely. Repeated attempts push the firewall into maintenance mode, which is the state engineers normally reach deliberately after a failed upgrade, not one they want an outside party choosing for them.
CVSS 4.0 scores it 6.6, severity MEDIUM, with the vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:H. Read the privilege field: PR:N means no account, no token and no management session. Only availability degrades, which is why the score sits in the middle band while the operational consequence does not.

Why the dataplane matters more than the score

Most PAN-OS issues that make headlines require an administrator login, a compromised session or a specific management-plane exposure. This one lands on the path that carries user traffic. A perimeter firewall whose dataplane is being hammered is a perimeter firewall that cannot enforce policy, and every segment behind it inherits that gap until service returns.
The maintenance-mode detail changes the recovery profile. A transient outage caused by packet floods usually clears when the traffic stops. A device parked in maintenance mode needs an operator to intervene. That converts a network event into a site visit, a change ticket and possibly a support case.

Scope, precisely

The record lists affected PAN-OS branches with fixed releases at the time of publication:

  • 10.2 before 10.2.18-h12, with hotfixes from 10.2.7-h38, 10.2.10-h41, 10.2.13-h26 and 10.2.16-h11

  • 11.1 before 11.1.16-h3, with hotfixes from 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35 and 11.1.13-h15

  • 11.2 before 11.2.16, with hotfixes from 11.2.4-h22, 11.2.7-h21, 11.2.10-h15 and 11.2.13-h3

  • 12.1 before 12.1.10-h2, with hotfixes from 12.1.4-h12 and 12.1.7-h8

  • 12.2 before 12.2.4
    Cloud NGFW and Panorama are explicitly not affected by this specific issue. That matters for teams running mixed estates: a Panorama management plane can be patched on a different schedule without pretending it fixes the firewall dataplanes underneath.

The honest gap in vendor-side mitigation

The record states that no known workarounds exist. Customers holding a Threat Prevention subscription get limited coverage by enabling Threat ID 510038 from Applications and Threats content 9158-10284 onward, and that signature requires SSL Decryption to apply. Limited coverage that depends on decryption is a supplement, not a substitute for upgrading. Anyone who cannot decrypt traffic should assume zero inline protection for this vector.

What to do this week

Inventory every PAN-OS instance, note its branch and hotfix line, and treat internet-facing dataplanes as the first upgrade wave. Where an upgrade window is genuinely blocked, shorten it rather than cancelling it: the failure mode can be triggered repeatedly, and each trigger has a chance of leaving the device in maintenance mode. Confirm with the vendor how a given HA pair behaves under repeated triggers before relying on failover as a control.

Where exposure measurement helps and where it misleads

A ZoomEye search for app="Palo Alto Networks" returned 22,599 matching assets when checked on 22 October 2026, while vul.cve="CVE-2026-0321" returned 0 because the CVE was days old at the time of the query. Neither number tells you how many firewalls are actually vulnerable. The first counts assets that look like the product family, and the second shows how quickly CVE indexing catches up with a fresh identifier. Use them to size a conversation with asset owners, then verify versions from your own management plane.

The takeaway

Availability-only bugs get deprioritised because they do not steal data. Here the attacker needs no credentials, the damage is service-wide, and the recovery path runs through maintenance mode. That is a patch queue argument strong enough to survive a change board.